Skip to content

fix(deps): require secure Pillow release #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paul-cch merged 1 commit into from
Jul 14, 2026
Merged

fix(deps): require secure Pillow release #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,6 @@ All notable changes to this project are documented in this file.
- Theme watcher startup and wallpaper cycling now avoid first-run double-cycle races.

### Security
- Raised the minimum Pillow version to `12.2.0` to exclude vulnerable releases.
- Path overrides in setup/install flows are validated and constrained to the current user home.
- LaunchAgent plist rendering now XML-escapes substituted install paths.
2 changes: 1 addition & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
Pillow>=10.0
Pillow>=12.2.0

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Enforce the Pillow floor in the installer path

For the production path recommended by the README (bash install.sh), this new requirement is never applied: install.sh only accepts any interpreter where import PIL succeeds (lines 140 and 165) and then writes that interpreter into the LaunchAgent. Users who already have Pillow 10.x/11.x and rerun the installer will still be accepted and continue processing wallpapers with the vulnerable Pillow version, so this dependency floor only protects environments that manually run pip install -r requirements.txt.

Useful? React with 👍 / 👎.

pyobjc-framework-Quartz>=10.0
Loading